How to Run a Tabletop Exercise for Your Regulation S-P Response Program

Amended Regulation S-P requires every SEC-registered adviser to have a written incident response program. 17 CFR 248.30(a)(3) says the program must be:

reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures

The rule does not say you have to test it. But a plan nobody has walked through is a guess. Without a test, you find out whether it works during a real incident, with the 30-day notice clock running.

A tabletop exercise is a cheaper way to find out. It is a meeting. You sit down with the people who would handle an incident, walk through a realistic scenario, and see where the plan breaks. No systems are touched.

The fiscal 2027 exam priorities cover response programs

The SEC's fiscal 2027 examination priorities, a staff statement released October 23, 2026, say staff will evaluate response program policies and procedures, including customer notification procedures and oversight of service providers. A written record of a tabletop exercise, with the gaps you found and what you changed, is a direct way to show that your procedures are more than paper.

Four people to have in the room

Keep it small. For most small RIAs that means:

• the CCO, who owns the program and the notice decision
• whoever runs operations day to day
• your IT provider, who would do the technical work
• the owner or managing partner, who approves spending and client communication

Counsel and your cyber insurer are optional for a first run. Have their phone numbers on the table either way, because the scenario will need them.

One person runs the exercise and keeps notes. It works best when that person is not also the one answering the questions.

A Regulation S-P tabletop scenario in six steps

Pick a scenario that touches every part of 248.30(a)(3), (a)(4), and (a)(5). Here is one that fits most small firms. Read each step aloud, then stop and let the group answer the questions before moving on.

Step 1. Your IT provider calls

It is a Tuesday morning. Your IT provider calls. A staff member's mailbox was signed into from overseas twelve days ago. The attacker set up a rule forwarding copies of incoming mail to an outside address. The mailbox holds client statements, and some contain account numbers.

• Who takes this call? Who do they call next?
• What date did the firm become aware? Write it down. The 30-day notice clock in 248.30(a)(4)(iii) runs from when the firm becomes aware that unauthorized access to customer information has occurred or is reasonably likely to have occurred.

Step 2. Assess and contain

248.30(a)(3)(i) and (ii) require procedures to assess the nature and scope of the incident, identify the systems and types of customer information involved, and contain and control it.

• Who resets the password, ends the sessions, and removes the forwarding rule?
• How do you find out what was forwarded? How far back do the logs go?
• Who checks whether other mailboxes have the same rule?

Step 3. Is it sensitive customer information?

Account numbers with nothing else may or may not be sensitive customer information under 248.30(d)(9). Account numbers with the codes that open the account are. Check what your statements include.

• Who decides? On what facts?
• 248.30(a)(4)(i) lets the firm skip notice only if, after a reasonable investigation, it determines the sensitive customer information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience. Who runs that investigation, and where is it written down?

Step 4. Who gets notice

Your IT provider can see that the forwarding rule ran for twelve days, but not which messages the attacker opened.

• Under 248.30(a)(4)(ii), if you cannot tell whose sensitive customer information was accessed, notice goes to everyone whose sensitive customer information was in the affected system. How many clients is that?
• Does your notice template include every item 248.30(a)(4)(iv) requires: what happened, the type of information, the dates, how to contact the firm, a reminder to review account statements, fraud alerts, credit reports, and FTC identity theft guidance?
• Who signs the letter, and who answers the phone when clients call?

Step 5. A vendor reports its own incident

Day three. Your CRM vendor emails to say it had a security incident last week. It is still investigating.

• Under 248.30(a)(5)(i)(B), your policies must be reasonably designed to ensure service providers notify the firm as soon as possible, and no later than 72 hours after becoming aware of a breach that results in unauthorized access to a customer information system they maintain. Did this notice arrive in time? What does your contract or the vendor's attestation say?
• The same paragraph says that once you receive the notice, the firm must initiate its incident response program. Is this now a second incident in your log?
• Who at the vendor is your contact? Is it written down anywhere?

Step 6. Insurance and records

• Does your cyber insurance policy require you to call the insurer before hiring outside help? Who has the policy number?
• What will you keep? Rule 204-2(a)(25)(ii) and (iii) require records of the incident, the response and recovery, the notice investigation and the basis for the decision, and a copy of any notice sent. Who is keeping the timeline right now?

Write down what you found and what you changed

The written record matters as much as the exercise itself. When you finish, write down:

• the date, who attended, and the scenario
• what worked
• what did not, as a list of gaps
• an owner and a due date for each gap
• the changes you made to the plan, with the new version date

Keep the write-up with your compliance records. Next year, the write-up shows that you tested the program and acted on what you found.

Five gaps to look for in a first run

Check for each of these:

• No one knows exactly who decides whether notice is required.
• The contact list lives only in email, which is the system that is down.
• The notice template is missing one or more of the required items.
• The firm does not know how long its mail logs are kept.
• Vendor contracts are silent on the 72-hour notice, and no one asked for an attestation.

Each of these is cheap to fix in a quiet week and expensive to fix in the middle of an incident.

Run it once a year and after major changes

The rule does not set a frequency. Once a year is a reasonable baseline. Run another after a real incident, a new IT provider, or a major system change. Change the scenario each time: a lost laptop, a wire fraud attempt, a ransomware outage at a vendor.

Templates for the exercise and the follow-up

• Our free Incident Response Plan template has roles, severity levels, checklists, and a notice deadline table that includes Regulation S-P.
• Sections 3 and 4 of the Regulation S-P Cybersecurity Checklist cover the response program and customer notification. Run them after the exercise to check your fixes.
• If the vendor step exposed gaps, the Vendor Security Review template and our post on proving your vendor reviews happened cover the follow-up.

If you want an outside facilitator for the exercise, or help rewriting the plan after it, book a consult.

This post is general information, not legal advice. Notice decisions belong with your counsel. SaberGuard assesses and advises; it does not warrant compliance.